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-Times tairp 

TI-8tart-*time In seconds (since 1970 GMT) 
mr-duration o£ validity C£or time groiiping) 

---Structural Fields 

QB-indicator that this row is an output of grouping 

operation 

MP-indicator that this 3?ow is a ma^^ing or lookup row 

Key Fields (this category includes Secondary Key Fields) : 

Ca)-collection device (i,e. origin of the data) 
DA-destination MAC address (as. stated by KRP packet) 
DD-destination domain (DNS style) 
DX-destinatioR IP nuniber 

DM-destination HAC address (true MAC address) 
DN-normalised destination address 
DP-destination TCP port or XSDB port 
EP-Ethemet protocol number 
PR-IP protocol number 

SA- source MAC address (as stated by ARP packet) 
SD-source domain (DNS style) 
SI -source IP number 

SM-source MAC address (true MAC address) 
SN-normalised source address 
SP-source TCP port or TIDP port 

— Secondary Key Fields (actually, special case of Key Fields) 

TF-traf£ic flow 
AC- account category 
SA-sub-account category 
CC-cost centre category 

Counter fields 

B7-ootmt of bytes 

PK-count of packets 
HT-count of web hits 
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